nodeTLSSecret and Custom Certs about cockroach-operator HOT 9 CLOSED

statefulset-controller  create Pod crdb-0 in StatefulSet crdb failed error: Pod "crdb-0" is invalid: [spec.volumes[1].projected.sources[1].secret.name: Required value, spec.containers[0].volumeMounts[1].name: Not found: "certs"]

from cockroach-operator.

in example.yaml we have a field:

nodeTLSSecret: GENERATED

This is stopping the operator from creating a TLSecret, and I do not understand what the purpose of the field in the API is. https://github.com/cockroachdb/cockroach-operator/blob/master/api/v1alpha1/cluster_types.go#L18 is the definition.

We are checking to see if this field is empty and if it is the TLSSecret is generated.

I am guessing that we have this field in order to allow for custom certs. @johnrk is this a requirement?

from cockroach-operator.

I think this allows for a user to create a Kubernetes secret that contains a certificate. Then use that secret as the cert when a cluster starts.

from cockroach-operator.

@chrislovecnm , creating a secure cluster is a requirement. And I assume the former engineer working on this intended to enable that here.

@chrisseto , is this consistent with your understanding?

from cockroach-operator.

"nodeTLSSecret: GENERATED" was used in the past implementation to force the operator to generate k8s cluster signed SSL certificates when they were not provided. This was done to match the functionality existing in the Helm chart. Later, I simplified it so that the generation happens if TLSEnabled is set to true but no secrets are provided.

from cockroach-operator.

@vladdy thanks! I was wondering if you going to allow for the naming of the secrets with the self-signed certs in them. Would be great to set up 1/2 hour say next week. I need to document the API and I think it would be great to get more information from you.

from cockroach-operator.

@chrislovecnm, sure we can chat. I've also created #49 to add more info. Unfortunately, it looks like I lost permissions to add reviewers, so I hope somebody will notice it.

from cockroach-operator.

@johnrk this is complete. We need to document it and probably improve validation

from cockroach-operator.

Closing - duplicate

from cockroach-operator.